GHSA-6g2r-675j-hx59
Suggest an improvement- Source
- https://github.com/advisories/GHSA-6g2r-675j-hx59
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-6g2r-675j-hx59/GHSA-6g2r-675j-hx59.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/GHSA-6g2r-675j-hx59
- Published
- 2026-10-02T18:29:13Z
- Modified
- 2026-10-02T18:45:09Z
- Severity
-
- 2.3 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
- Summary
- xxhash-rust: Safe xxh3 custom-secret API accepts too-short secret in release
- Details
-
I have a minimized safe Rust witness for xxhash-rust 0.8.15.
Safe public route:
xxhash_rust::xxh3::xxh3_64_with_secret(&[0x41], &[])
The caller-side harness contains no unsafe code. Under release execution, the internal minimum custom-secret length predicate is enforced only by debug_assert!. Release-Miri reports construction of a fixed-width reference beyond the empty secret allocation.
Observed diagnostic:
Undefined Behavior: constructing invalid value of type &[u8; 4]: encountered a dangling reference
Local repair evidence: handling custom-secret slices shorter than the internal minimum before fixed-width secret reads makes the same safe short-secret harness pass under Linux release-Miri.
Local artifacts:
- vulnerable log: artifacts/logs/W-4332_xxhash_rust_short_secret_miri_release_linux_001.log
- repair log: artifacts/logs/differentials/W-4332_xxhash_rust_local_repair_miri_release_linux_001.log
- report: artifacts/reports/W-4332_xxhash_rust_short_secret_report.md
- Database specific
{ "cwe_ids": [ "CWE-125" ], "github_reviewed": true, "github_reviewed_at": "2026-10-02T18:29:13Z", "nvd_published_at": null, "severity": "LOW" }- References
Affected packages
crates.io / xxhash-rust
Package
- Name
- xxhash-rust
- View open source insights on deps.dev
- Purl
- pkg:cargo/xxhash-rust